3 ms·

> PHP is written expressly for the web, not like Java, Python, Ruby or whatever the latest fad is these days - where web stuff was bolted on instead of baked in

> PHP is written expressly for the web, not like Java, Python, Ruby or whatever the latest fad is these days - where web stuff was bolted on instead of baked in the design and operations of the language. Is it though? How come something written expressly for the web does not include a simple and safe way to output untrusted input without being vulnerable to XSS attacks? <?php echo htmlspecialchars($var) ?> is a joke.

krapp 11y ago
It is. PHP was clearly never designed with safety in mind, though, which is very unfortunate. The web would be a much better place if PHP tainted and escaped variables by default. Although, to be fair, the solution to this is still the same as with any other web-facing language - use a framework (which will, eventually, just wrap htmlspecialchars around everything for you.) It just happens that other languages make those decisions for you and PHP doesn't. Developers pretend those languages are more "secure" when really the ugly low level stuff is just already hidden behind abstractions before they even approach a project.
mschuster91 11y ago
Better to know that by default ANYTHING is unsanitized than this: $a=$_GET["username"]; echo "Hello & Welcome $a"; By tainting, the & in the & would be double escaped as $a would carry its taint over to the output string. No thanks, I like to know what is escaped and where.
- justinsaccount 11y ago
  Right, because in any sane templating library you would just have something like Hello & Welcome {{a}} but despite being "built for the web", php is not a sane templating language for dealing with html. Facebook's XHP solves this problem: https://github.com/facebook/xhp-lib#escaping https://github.com/facebook/xhp-lib#escaping "An interesting feature of XHP is the idea of automatic escaping" ... "As you can see, using XHP makes safety the default rather than the exception." Unfortunately your standard php hosting site is not running hhvm.

krapp 11y ago

It is. PHP was clearly never designed with safety in mind, though, which is very unfortunate. The web would be a much better place if PHP tainted and escaped variables by default. Although, to be fair, the solution to this is still the same as with any other web-facing language - use a framework (which will, eventually, just wrap htmlspecialchars around everything for you.) It just happens that other languages make those decisions for you and PHP doesn't. Developers pretend those languages are more "secure" when really the ugly low level stuff is just already hidden behind abstractions before they even approach a project.

mschuster91 11y ago

Better to know that by default ANYTHING is unsanitized than this: $a=$_GET["username"]; echo "Hello & Welcome $a"; By tainting, the & in the & would be double escaped as $a would carry its taint over to the output string. No thanks, I like to know what is escaped and where.

justinsaccount 11y ago
Right, because in any sane templating library you would just have something like Hello & Welcome {{a}} but despite being "built for the web", php is not a sane templating language for dealing with html. Facebook's XHP solves this problem: https://github.com/facebook/xhp-lib#escaping https://github.com/facebook/xhp-lib#escaping "An interesting feature of XHP is the idea of automatic escaping" ... "As you can see, using XHP makes safety the default rather than the exception." Unfortunately your standard php hosting site is not running hhvm.